CVE-2026-65876

The Joomla extension SP Page Builder (Free and Pro) versions 4.0.0–6.9.0 contains a Missing Access Control vulnerability in menu item creation. The add-to-menu routine invoked the com_menus item model's save() method directly; that model does not perform authorisation itself, because the relevant checks reside in the com_menus controller, and the only check applied was core.edit on com_sppagebuilder. Users with no permissions whatsoever on com_menus could therefore create menu items, and because the record identifier was taken from the submitted jform[menuid] field, could also overwrite existing ones. The home flag was read back from the database and preserved, so the site's home menu item could be repointed while remaining the home item.

In the SP Page Builder extension (versions 4.0.0 - 6.9.0), the folder request parameter replaced the generated date-based destination folder entirely and was passed to Folder::create() and File::upload() without directory boundary checks. This allowed files to be written into any directory beneath the web root, including administrator/, templates/, cli/ and the site root. Joomla's PATH input filter prevented traversal above the web root, and existing files were not overwritten.

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The media rename task applied neither of the directory boundary checks used by the folder operations in the same controller, and its validation guard required only that either a media record exist for the supplied identifier or that the supplied path be present in #__spmedia, rather than both. The identifier and the path were consequently never checked against one another, so any valid media identifier could be paired with an unrelated filesystem path, and the STR input filter left traversal sequences intact. An attacker could rename files elsewhere in the installation, including renaming configuration.php to take the site offline.

Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0 - plgContentSppagebuilder::onContentAfterSave() read jform[attribs][sppagebuilder_article_id] from the request and concatenated it directly into the WHERE view_id = ... clause of a query against #__sppagebuilder without quoting or type casting. Joomla's ARRAY input filter does not sanitise element values, as InputFilter::clean() returns (array) $source with the elements untouched, so the entire payload could be delivered in a single POST field. The affected block also executed before the com_content.article context test, so it ran on every onContentAfterSave event regardless of which component triggered the save. An attacker could perform time-based blind SQL injection to read arbitrary database contents, including the #__users and #__session tables.

Joomla extension SP Page Builder before version 6.8.0 contains an unauthenticated arbitrary local PHP file inclusion vulnerability. An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1. The hardcoded secret allowed attackers to forge the mail from address of forms.

The SP Page Builder extension for Joomla versions below 6.7.1 contains an unauthenticated SQL injection vulnerability in the Dynamic Content endpoint due to improper validation of the order parameter.

In Joomla extension SP Page Builder before 6.8.0, an unauthenticated attacker can create comments even when guest commenting is disabled by overriding the setting with user-supplied input.

In Joomla extension SP Page Builder before 6.8.0, an unauthenticated attacker can create arbitrary directories and files with a predefined name.